Oracle Concurrent Processing EUVD-2026-106103

Exploitation requires the attacker to already have an interactive logon on the infrastructure where Oracle Concurrent Processing executes AND to hold high privileges on that system (CVSS AV:L + PR:H), targeting the Request Submission and Scheduling component of Oracle Concurrent Processing in Oracle E-Business Suite versions 12.2.3 through 12.2.15. The principal limiting factors are therefore the mandatory local access and the requirement for pre-existing elevated privileges; no remote or unauthenticated path is indicated and no user interaction is needed (UI:N). The scope change (S:C) means a successful attack can read critical data in other Oracle E-Business Suite products beyond Concurrent Processing itself; impact is confined to confidentiality (no integrity or availability effect).

This is a moderate-priority, not a top-priority, issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.0) tells a consistent story: exploitation requires LOCAL access (AV:L) AND already-high privileges (PR:H) - i.e. an attacker who can log on to the infrastructure where Oracle Concurrent Processing runs and already holds elevated rights. That high bar sharply limits real-world risk despite the confidentiality-only 'High' impact and the scope change (S:C) that lets the attack reach additional Oracle E-Business Suite products. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The description's phrase 'high privileged attacker with logon to the infrastructure' aligns well with PR:H + AV:L, so there is no CVSS-vs-description conflict here. Net: a genuine but constrained insider/post-compromise confidentiality risk, not an internet-facing emergency. Note the input Tag 'Authentication Bypass' conflicts with the data - PR:H means the attacker must already be authenticated and privileged, which is the opposite of an auth bypass; treat that tag as suspect.

An attacker who already has a high-privileged local account on the server hosting Oracle Concurrent Processing (for example a compromised administrative or application operator account) abuses the Request Submission and Scheduling component to read critical data belonging not only to Concurrent Processing but, via the scope change, to other Oracle E-Business Suite products. No public exploit code is available, and because the CVSS vector is local with high privileges required, the scenario is realistically a post-compromise or malicious-insider action rather than remote mass exploitation.